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What is claimed: 

1 . A method for processing networl< traffic content, the method comprising: 
receiving a content stream having an operation code and an operand; and 
building a new stream by either adding data to the operation code or 

removing the operand from the content stream. 

2. The method of claim 1 , wherein the building the new stream comprises 
adding data to the operation code. 

3. The method of claim 2, wherein the data comprises one or more values 
representative of a length of an instruction. 

4. The method of claim 2, wherein the adding data to the operation code 
comprises adding a first variable before an instruction data of the content stream 
and a second variable after an instmction data of the content stream. 

5. The method of claim 1 , wherein the building the new stream comprises 
removing the operand from the content stream. 
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6. The method of claim 5, wherein the content stream comprises one or 
more additional operation code, and the method further comprising sorting the 
operation codes after the operand is removed. 

7. The method of claim 5, wherein the building the new stream further 
comprises removing a noise operation code from the content stream. 

8. The method of claim 7, wherein the content stream comprises one or 
more additional operation code, and the method further comprising sorting the 
operation codes of the content stream after the noise operation code is removed. 

9. The method of claim 1 , further comprising creating a model using at least 
a portion of the new stream. 

10. The method of claim 9, wherein the model is selected from the group 
consisting of a Strict model, a Normal model, a Free model, and a Quiet model. 

1 1 . The method of claim 9, wherein the creating comprises performing a cyclic 
redundancy check on at least a portion of the new stream. 
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1 2. The method of claim 1 1 , wherein the at least a portion of the new stream 
comprises a first 12 bytes, a first 18 bytes, a first 24 bytes, a first 30 bytes, or a 
first 36 bytes, of the new stream. 

1 3. The method of claim 9, further comprising: 
providing a bit table for the model; and 

searching the bit table to detennine if the model is represented by a bit set 
in the bit table. 

14. The method of claim 13, further comprising: 

providing a cyclic redundancy check table for the model, the cyclic 
redundancy check table having a plurality of cyclic redundancy check elements; 
and 

searching the cyclic redundancy check table to determine if the model 
matches with one of the plurality of cyclic redundancy check elements in the 
cyclic redundancy check table. 

1 5. The method of claim 14, further comprising verifying a detection of a 
content when the model matches with a cyclic redundancy check element in the 
cyclic redundancy check table. 
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16. The method of claim 15, wherein the verifying comprises comparing a 

parameter obtained during a processing of the content stream with a verifier of a 

cyclic redundancy check element. 

5 17. A system for processing network traffic content, the system comprising: 
means for receiving a content stream having an operation code and an 
operand; and 

means for building a new stream by either adding data to the operation 
code or removing the operand from the content stream. 

10 

1 8. The system of claim 1 7, further comprising means for creating a model 
using at least a portion of the new stream. 

19. The system of claim 18, wherein the model is selected from the group 
15 consisting of a Strict model, a Normal model, a Free model, and a Quiet model. 

20. The system of claim 18, wherein the means for creating performs a cyclic 
redundancy check on at least a portion of the new stream. 

20 21 . The system of claim 20, wherein the at least a portion of the new stream 
comprises a first 12 bytes, a first 18 bytes, a first 24 bytes, a first 30 bytes, or a 
first 36 bytes, of the new stream. 

30 
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22. The system of claim 1 8, further comprising: 
means for providing a bit table for the model; and 

means for searching the bit table to determine if the model is represented 
5 by a bit set in the bit table. 

23. The system of claim 22, further comprising: 

means for providing a cyclic redundancy check table for the model, the 
cyclic redundancy check table having a plurality of cyclic redundancy check 
10 elements; and 

means for searching the cyclic redundancy check table to determine if the 
model matches with one of the plurality of cyclic redundancy check elements in 
the cyclic redundancy check table. 

15 24. The system of claim 23, further comprising means for verifying a detection 
of a content when the model matches with a cyclic redundancy check element in 
the cyclic redundancy check table. 

25. The system of claim 24, wherein the means for verifying compares a 
20 parameter obtained during a processing of the content stream with a verifier of a 
cyclic redundancy check element. 
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26. A computer product having a set of stored instructions, the execution of 
which causes a process to be performed, the process comprising: 

receiving a content stream having an operation code and an operand; and 
building a new stream by either adding data to the operation code or 
5 removing the operand from the content stream. 

27. The computer product of claim 26, wherein the building comprises adding 
data to the operation code. 



10 28. The computer product of claim 26, wherein the building comprises 
removing the operand from the content stream. 

29. A method for processing network traffic content, the method comprising: 
receiving a content stream, the content stream having an operation code 
15 and an operand; 

building a new stream by either adding data to the operation code or 
removing the operand from the content stream; 

creating a first model using at least a portion of the new stream; and 
searching a first cyclic redundancy check table to determine if the first 
20 model matches with a cyclic redundancy check element stored in the first cyclic 
redundancy check table. 
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30. The method of claim 30, wherein the building the new stream comprises 
adding data to the operation code. 

31 . The method of claim 31 , wherein the adding data to the operation code 

5 comprises adding a first variable before an instruction data of the content stream 
and a second variable after an Instruction data of the content stream. 

32. The method of claim 29, further comprising: 

creating a second model using raw data of the content stream; and 
10 searching a second cyclic redundancy check table to determine if the 

second model matches with a cyclic redundancy check element stored In the 
second cyclic redundancy check table. 

33. The method of claim 32, wherein the creating the second model 
15 comprises removing the operand from the content stream. 

34. The method of claim 32, further comprising: 

creating a third model using raw data of the content stream; and 
searching a third cyclic redundancy check table to determine If the third 
20 model matches with a cyclic redundancy check element stored In the third cyclic 
redundancy check table. 
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35. The method of claim 34, wherein the content stream comprises one or 
more additional operation codes, and wherein the creating the third model 
comprises: 

removing the operand from the content stream; and 

sorting the operation codes of the content stream after the removing. 

36. The method of claim 29, further comprising: 

creating a quiet model using raw data of the content stream; and 
searching a quiet bit table to determine if the quiet model is represented 
by a bit set stored In the quiet bit table, wherein the searching the quiet bit table 
is perfonmed before the searching the first cyclic redundancy check table. 

37. The method of claim 36, further comprising: 

creating a strict model using raw data of the content stream; and 
searching a strict bit table to detemiine if the strict model Is represented by 
a bit set stored in the strict bit table. 

38. The method of claim 37, further comprising: 

creating a normal model using raw data of the content stream; and 
searching a nomial bit table to detemnine If the normal model is 
represented by a bit set stored in the normal bit table. 
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39. The method of claim 48, further comprising: 

creating a free model using raw data of the content stream; and 
searching a free bit table to detemiine if the free model is represented by 
a bit set stored in the free bit table. 

5 

40. A system for processing network traffic content, the system comprising: 
means for receiving a content stream, the content stream having an 

operation code and an operand; 

means for creating a new stream by either adding data to the operation 
10 code or removing the operand from the content stream; 

means for creating a model using at least a portion of the new stream; and 
means for searching a cyclic redundancy check table to determine if the 

model matches with a cyclic redundancy check element stored in the cyclic 

redundancy check table. 

15 

41 . A computer product having a set of stored instmctions, the execution of 
which causes a process to be performed, the process comprising: 

receiving a content stream, the content stream having an operation code 
and an operand; 

20 creating a new stream by either adding data to the operation code or 

removing the operand from the content stream; 

creating a model using at least a portion of the new stream; and 
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searching a cyclic redundancy check table to determine if the model 

matches with a cyclic redundancy check element stored in the cyclic redundancy 

check table. 

42. A method for processing network traffic content, the method comprising: 
receiving a content stream; 

creating a first model using raw data of the content stream; and 
searching a first bit table to determine if the first model is represented by a 
bit set stored in the first bit table. 

43. The method of claim 42, wherein the first model comprises a quiet model. 

44. The method of claim 42, further comprising: 

creating a second model using raw data of the content stream; and 
searching a second bit table to determine if the second model is 
represented by a bit set stored in the second bit table. 

45. The method of claim 44, wherein the second model is selected from the 
group consisting of a strict model, a normal model, and a free model. 
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46. The method of claim 44, further comprising searching a cyclic redundancy 
check table to determine If the second model matches with a cyclic redundancy 
check element stored in the cyclic redundancy check table. 

47. The method of claim 46, wherein the cyclic redundancy check table is 
selected from the group consisting of a strict cyclic redundancy check table, a 
nornnal cyclic redundancy check table, and a free cyclic redundancy check table. 

48. A system for processing network traffic content, the system comprising: 
means for receiving a content stream; 

means for creating a first model using raw data of the content stream; and 
means for searching a first bit table to detemnine if the first model is 
represented by a bit set stored in the first bit table. 

49. A computer product having a set of stored instructions, the execution of 
which causes a process to be performed, the process comprising: 

receiving a content stream; 

creating a first model using raw data of the content stream; and 
searching a first bit table to determine if the first model is represented by a 
bit set stored in the first bit table. 
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